liveBook · Manning

Delegation right

As explained in Authorization in Action

A delegatable right is an authorization that permits its holder to grant access or delegate authority to another principal.

A delegation right is authorization to grant another principal access or authority. It differs from permission to use a resource: opening a document does not automatically permit sharing it. section 9.5.1

A document owner may choose who can access a document, while a separate delegatable attribute determines whether authorized readers may share it. This separation prevents accidental authority transfer. section 9.5.1

Controlled document sharing

An employee can share a document only when the document is marked delegatable and the employee belongs to its readers team. A customer reader may view a document without gaining sharing authority. section 9.5.1

How Authorization in Action covers it

How deep it goes
Defines a typed delegatable attribute and applies it with team membership in a Cedar policy.
Examples
Uses document owners, employee and customer reader teams, document viewing, and controlled document sharing.
What it assumes
Builds on Cedar schemas defining entity types, attributes, actions, and relationships.
What you can do after
Apply it via Cedar by requiring an explicit delegatable attribute before permitting resource sharing.
How it connects
Connects discretionary permissions, membership permissions, relationship permissions, RBAC, ABAC, ReBAC, and zero-trust constraints.
Cover of Authorization in Action
liveBookmanning.com
Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.